Any description of collected data

[mjaeger]

Hi,
I've installed the TA for F5 and startet collecting data using the original templates - and it would be very helpfull to have any kind of description of the collected values. I've tried to find some more information at the F5 web site (devcentral), but besides a documentation about the icontrol interface there was nothing realy usefull.

Currently I'm trying to find out how to interpret the CPU and RAM values from the "f5:bigip:system:systeminfo:icontrol" template...

Thanks
Martin

[lding_splunk · Accepted solution]

Hi Martin,

Sorry to bring you trouble for this.
Let me clarify your question:
1. You have successfully installed the add-on, connected to F5 BIG-IP, and can collect some data by defining a task which uses the F5 BIG-IP server and uses the standard collection template "Standard_System".
2. Your question is "how to use the data in search language and understand the format of those data which you have already indexed into Splunk for sourcetype: f5:bigip:system:systeminfo:icontrol, right?

Answers:

1. As mentioned in below link, you can see the format of those indexed data are actually JSON format which is mapped the data format from F5 BIG-IP iControl SDK. http://docs.splunk.com/Documentation/AddOns/latest/F5BIGIP/Createnewtemplates
2. Every index data will has a field named "module_interface", for example, "module_interface": "System.SystemInfo", the format of the content could be got from: https://devcentral.f5.com/wiki/iControl.System__SystemInfo.ashx https://devcentral.f5.com/wiki/icontrol.apireference.ashx
3. Take CPU and RAM usage as example as you mentioned, below SPL are examples as reference, which will show the CPU trend, another one is RAM usage trend: sourcetype="f5:bigip:system:systeminfo:icontrol" cpu_usage_percent=* sourcetype="f5:bigip:system:systeminfo:icontrol" memory mem_used=*

[mjaeger]

Hi,

Thank you for your answer. I hope that this information will help me to get more about the data collected with this TA.

Regards
Martin